Fix use after free on AST expressions in constant declarations

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index a5d50abc262191cf424fd405d01d12502d29cd25..3f149ec7abc25bb9b1bc8b8d2e82d15f53366a25 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -7170,17 +7170,13 @@ ZEND_VM_HANDLER(143, ZEND_DECLARE_CONST, CONST, CONST)
        name  = GET_OP1_ZVAL_PTR(BP_VAR_R);
        val   = GET_OP2_ZVAL_PTR(BP_VAR_R);
 
-       ZVAL_COPY_VALUE(&c.value, val);
+       ZVAL_COPY(&c.value, val);
        if (Z_OPT_CONSTANT(c.value)) {
                if (UNEXPECTED(zval_update_constant_ex(&c.value, EX(func)->op_array.scope) != SUCCESS)) {
                        FREE_OP1();
                        FREE_OP2();
                        HANDLE_EXCEPTION();
                }
-       } else {
-               if (UNEXPECTED(Z_OPT_REFCOUNTED(c.value))) {
-                       Z_ADDREF(c.value);
-               }
        }
        c.flags = CONST_CS; /* non persistent, case sensetive */
        c.name = zend_string_dup(Z_STR_P(name), 0);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 38ed5883afbcffc05b912dafb7e6c77a51c03a3e..0ed33856f557f3e9195f336b802b290e12501d66 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6083,17 +6083,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DECLARE_CONST_SPEC_CONST_CONST
        name  = EX_CONSTANT(opline->op1);
        val   = EX_CONSTANT(opline->op2);
 
-       ZVAL_COPY_VALUE(&c.value, val);
+       ZVAL_COPY(&c.value, val);
        if (Z_OPT_CONSTANT(c.value)) {
                if (UNEXPECTED(zval_update_constant_ex(&c.value, EX(func)->op_array.scope) != SUCCESS)) {
 
 
                        HANDLE_EXCEPTION();
                }
-       } else {
-               if (UNEXPECTED(Z_OPT_REFCOUNTED(c.value))) {
-                       Z_ADDREF(c.value);
-               }
        }
        c.flags = CONST_CS; /* non persistent, case sensetive */
        c.name = zend_string_dup(Z_STR_P(name), 0);